That's the thing; we don't know if they use the laptops only for internet access or if they also do work on them. I kinda doubt they'd use them for working purposes because of the desktop computer that every occupied cubicle has.

As in my first post:
Our Internet security policy states that you are not allowed to have any device connected to our internal network and another network simultaneously. It also states that no non-corporate-owned or managed device can connect to our internal network.

It doesn't really state anything about countermeasures, other than "blah blah subject to punishment up to and including termination and possibly prosecution"...